coulomb/reuse-surface
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
reuse-surface/registry/capabilities/capability.infotech.isolated-login-browser.md
tegwick b91229d0de Catalog the attended empty-profile login browser. 
The headed Playwright Chromium used for a purpose-specific login is a
separate capability from the remote headless browser service.

Assistant: grok
Assistant-Session: 01a198fa-fd27-7e41-a0a2-57355c3e4efd
2026-11-02 02:59:57 +01:00

5.3 KiB
Raw Blame History

id name summary owner status domain tags maturity external_evidence discovery availability relations evidence consumer_guidance promotion_history
capability.infotech.isolated-login-browser Isolated Login Browser Headed empty-profile Chromium for one attended login. It uses the Chromium binary pinned by coulomb-social Playwright 1.62.1 (revision 1234, Chrome for Testing 151.0.7922.34) and a new user-data directory. It is not the Windows default browser and not the rapp-playwright headless service. reuse-surface draft infotech
attended-login
browser
chromium
empty-profile
playwright
discovery availability
current target confidence rationale
D2 D3 medium The boundary is one visible login page in a fresh profile. The remote headless browser is a neighboring capability and is excluded.
current target confidence rationale
A2 A3 medium The launcher is source in railiance-platform and calls the already installed Playwright Chromium cache. It is not a published installable command.
completeness reliability
level confidence basis satisfied_expectations broken_expectations out_of_scope_expectations
C1 low scope_vs_intent_and_consumer_expectations
A headed Chromium from the coulomb-social Playwright pin can be named and started with a fresh profile.
An attended OpenBao login has not completed in this profile.
Headless screenshots, keyboard trials, or a hosted browser service.
Credential custody, password entry, or one-time-code handling by the launcher.
level confidence basis known_reliability_risks
R1 low consumer_quality_signals
Two earlier login attempts opened the signed-in Windows default browser and timed out before the owner command.
The cache binary must match the coulomb-social Playwright pin or the launcher refuses to start.
A desktop display is required. There is no Windows-browser fallback.
intent includes excludes assumptions use_cases research_memos
Give an operator a visible browser with no saved account when a login must not reuse the workstation's default browser session.
Headed Chromium selected from coulomb-social's Playwright browsers pin.
A new empty profile for each allowed Keycloak login URL.
The local OpenBao OIDC callback on port 8250.
The Windows default browser, including Firefox and Edge.
rapp-playwright and any remote headless browser.
Reading, storing, or typing credentials.
The workstation already has the pinned Chromium in the Playwright cache.
DISPLAY or WAYLAND_DISPLAY is available to the login process.
Open the platform-root OpenBao login without an existing disposable-account session.
current_level target_level current_artifacts target_artifacts consumption_modes
A2 A3
../railiance-platform/scripts/operator-browser/xdg-open
../railiance-platform/scripts/openbao-attended-exec.py
../coulomb-social/scripts/node_modules/playwright-core/browsers.json
A small installable command whose only job is the empty-profile login window.
informational
source adaptation
cli
depends_on supports related_to
capability.infotech.headless-browser
documentation tests consumer_feedback bug_reports incidents
../railiance-platform/docs/backup-credential-recovery.md
../railiance-platform/tests/test_operator_browser.py
2026-11-02: the attended OpenBao window was Firefox, the Windows default, after a launcher intended to open Edge. The signed-in session could not be used for platform-root.
recommended_for not_recommended_for known_limitations
One attended login that must show the one-time-code page and return to localhost.
Screenshot or keyboard trials. Use capability.infotech.headless-browser.
Any flow that should reuse the operator's normal signed-in browser.
The launcher allowlists only the OpenBao Keycloak callback.
Closing the blank proof window is not a completed login.

Isolated Login Browser

Overview

This is the visible browser for a purpose-specific login. It starts the Chromium binary already installed for coulomb-social's Playwright tests, with a new empty profile, on the workstation display. The founder sees the identity page and completes the one-time code.

capability.infotech.headless-browser is the remote screenshot service. It does not show a local login page and cannot receive the OpenBao callback on localhost:8250.

Assessment notes

Discovery

The included behavior is one allowlisted Keycloak URL. Saved Windows sessions and headless trials are outside it.

Availability

Call python3 scripts/openbao-attended-exec.py from railiance-platform. The wrapper places scripts/operator-browser first on PATH, so OpenBao's xdg-open reaches this launcher.

Completeness

The browser selection and empty profile exist. A finished platform-root login in that window is still outstanding, so the core use case is not complete.

Reliability

The previous Windows opener disappointed the operator by presenting the default Firefox session. This entry stays fragile until one real login completes in the pinned Chromium.